PT-2025-4771 · Discourse · Discourse

Taisehub · Published 2025-02-04 · Updated 2025-08-26 · CVE-2025-23023

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L

Name of the Vulnerable Software and Affected Versions Discourse versions prior to the latest version

Description Discourse is an open source platform for community discussion. In affected versions, an attacker can carefully craft a request with the right request headers to poison the anonymous cache, which may have a response with missing preloaded data. This issue only affects anonymous visitors of the site.

Recommendations For versions prior to the latest version, users are advised to upgrade to the latest version of Discourse to resolve the issue. As a temporary workaround for users unable to upgrade, consider disabling anonymous cache by setting the DISCOURSE DISABLE ANON CACHE environment variable to a non-empty value.

Exploit

Fix

Origin Validation Error

Weakness Enumeration

CWE-346

Related Identifiers

BIT-DISCOURSE-2025-23023

CVE-2025-23023

GHSA-5H4H-2F46-R3C7

Affected Products

Discourse

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/23xxx/CVE-2025-23023.json · Exploit
• https://osv.dev/vulnerability/BIT-discourse-2025-23023 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-23023 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-23023 · Security Note
• https://github.com/discourse/discourse/security/advisories/GHSA-5h4h-2f46-r3c7 · Note
• https://twitter.com/bluepinksec/status/1887033741551288713 · Twitter Post
• https://t.me/cveNotify/133510 · Telegram Post
• https://twitter.com/CVEnew/status/1886891656932417992 · Twitter Post
• https://t.me/cvedetector/17248 · Telegram Post